Re: security advisory - which release?

[Jan-Henrik Haukeland]

Rick Robino <address@hidden> writes:

> Just noticed the security advisory, been pretty busy for a while here
> -
> I must have missed which release(s) the advisory applies to?  Just 4.2
> or earlier ones as well?  TIA.

Unfortunately earlier ones also (see the CHANGE log). All known
vulnerabilities are plugged in the current 4.2.1 release and you
should upgrade to this version.  It may be that some 3.x releases does
not have the Basic Auth. bug but they still have other vulnerabilities.
The safest is to upgrade to 4.2.1 which is the most hardened release
to date.

To be on the safe side (although I think it's safe now) you should
only run monit http bound to the loopback interface (so it's only
reachable from localhost) or run monit behind a firewall or simply
turn off the http interface although this reduce functional
interaction with monit.

-- 
Jan-Henrik Haukeland